Add support for ECDSA certificates

[ghost]

MeshCentral currently throws an exception and says that it only supports RSA when you replace the automatically generated certificate with an ECDSA certificate (e.g. when using MeshCentral in TLS Offloading mode).

[Ylianst]

This is not good. Do you have a way to generate such a certificate or have a sample certificate your can mail me? I imagine only the public portion on the certificate is provided to MeshCentral? - Thanks.

[ghost]

@Ylianst I can confirm that an error message appears when you replace the default webserver certificate with an ECDSA certificate. This is the error message in question from mesherrors.txt:

-------- 10/26/2018, 6:08:12 PM ---- 0.2.2-m --------

/meshcentral/node_modules/node-forge/js/x509.js:1274
    throw new Error('Cannot read public key. OID is not RSA.');
    ^

Error: Cannot read public key. OID is not RSA.
    at Object.pki.certificateFromAsn1 (/meshcentral/node_modules/node-forge/js/x509.js:1274:11)
    at Object.pki.certificateFromPem (/meshcentral/node_modules/node-forge/js/x509.js:716:14)
    at Object.obj.GetMeshServerCertificate (/meshcentral/node_modules/meshcentral/certoperations.js:230:42)
    at CreateMeshCentralServer.obj.StartEx2 (/meshcentral/node_modules/meshcentral/meshcentral.js:385:35)
    at Server.<anonymous> (/meshcentral/node_modules/meshcentral/redirserver.js:108:13)
    at Object.onceWrapper (events.js:273:13)
    at Server.emit (events.js:182:13)
    at emitListeningNT (net.js:1320:10)
    at process._tickCallback (internal/process/next_tick.js:63:19)

Here is the public portion of an ECDSA certificate that you can use for testing purposes:

-----BEGIN CERTIFICATE-----
MIIBtjCCAV0CFGuQrjcG9YbJi+rU5i3OMORbcmVGMAoGCCqGSM49BAMCMF4xCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQHDAlTYW4gRGll
Z28xEDAOBgNVBAoMB0V4YW1wbGUxFDASBgNVBAMMC2V4YW1wbGUuY29tMB4XDTE4
MTAyNjE4MjcyN1oXDTE5MTAyNjE4MjcyN1owXjELMAkGA1UEBhMCVVMxEzARBgNV
BAgMCkNhbGlmb3JuaWExEjAQBgNVBAcMCVNhbiBEaWVnbzEQMA4GA1UECgwHRXhh
bXBsZTEUMBIGA1UEAwwLZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMB
BwNCAAQzm9Cr/DMpsVBkjAIo+/E+bPYm/QXvsqXr8FlEjgu053hsSIG88eEAZDM6
J1I3HTuq0Frn+IqJfwpyezYA6LtzMAoGCCqGSM49BAMCA0cAMEQCIF2BAITu5kyo
oOsux/Uebq+pSLtt4esib26t2KnozFl+AiBgkGDBVgbeQrAR7mVGmd/KhnWa0ODv
Z/ucirO6TkfDog==
-----END CERTIFICATE-----

[ghost]

I think I've discovered the cause of this issue. MeshCentral is using the node version of forge for its native TLS implementation in Javascript. According to this, this and this issue on their GitHub project page, forge doesn't support ECDSA certificates yet. Unless there is a viable alternative to forge, there's probably nothing @Ylianst can do to solve this issue other than to wait for them to implement support for it.

Edit: I think crypto-browserify might be a suitable alternative to forge that supports ECDSA.

[Ylianst]

I may still be able to fix this because I don't need to do any certificate operations on this TLS cert, I just need to make sure the server and agents both see the same cert by having the same hash. So, if I work on this a bit I could hash the ECDSA cert on both sides correctly and not need ForgeJS at all.

Thanks for the ECDSA cert, I can give it a try.

[ghost]

@Ylianst Awesome, I'm glad to hear that. Good luck with implementing this feature!

[ghost]

@Ylianst I noticed that non-RSA cert hashes are being calculated after a recent commit, but it doesn't seem to be fully supported yet. The hashes that MeshCentral and MeshAgent calculate are different from each other. Is it supposed to be working right now?

[Ylianst]

I got the server ready, but the agent is not. So ECDSA will not work yet. Hope to start testing with a ECDSA cert this week.

[ghost]

@Ylianst You are on a roll lately. I love your passion for this project!

[Ylianst]

Just published MeshCentral v0.2.4-a with ECDSA support for certificates in the reverse-proxy. Only the MacOS agent does not support it in this version (next time MacOS is compiled on our side, the support for ECDSA will be there).

To be clear, MeshCentral will only generate and handle RSA certificates on it's own, however, if a reverse-proxy like NGNIX is in front of MeshCentral and it has a ECDSA certificates, MeshCentral and the MeshAgents will handle it correctly.

Testing and feedback appreciated.

[ghost]

@Ylianst I tested it and can confirm that MeshCentral works with ECDSA certificates now. I think you can close this issue.

[whlsxl]

I use lego to generate the TLS cert, the default --key-type is ec256. When I link the cert file to webserver-cert-private.key & webserver-cert-public.crt, forge not support ECDSA.

But I think that's not a big deal, just incase someone has the same problem.

https://go-acme.github.io/lego/usage/cli/options/
digitalbazaar/forge#925